Legal

Privacy Policy

Last updated: 29 August 2026

This Privacy Policy explains how ATOA ("ATOA", "we", "us", "our") collects, uses, shares, retains and protects information about you when you access or use the ATOA platform at atoa.ae and any related mobile applications, APIs or services (together, the "Platform"). It applies to all users of the Platform - real-estate agents, brokerage owners, brokerage staff, developers, and visitors.

The Platform is operated from the United Arab Emirates. By using ATOA you acknowledge that you have read and understood this Policy. Where UAE law requires your explicit consent, we will ask for it separately at the moment we need it.

1. About us and the Data Controller

ATOA is a UAE-based, agent-to-agent real-estate network used by licensed brokers to publish inventory, capture client requirements, match listings against requirements, chat, and close deals with a signed Agent-to-Agent contract. For the purpose of the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), the Data Controller is ATOA.

Privacy contact: privacy@atoa.ae
Support contact: support@atoa.ae

2. Information we collect

2.1 Account and identity data

Full name, email address, phone number and (optionally) WhatsApp number.
Role on the Platform (freelancer agent, brokerage owner, brokerage admin, brokerage agent, developer).
RERA Broker Registration Number (BRN) - required for every agent and printed on every Agent-to-Agent contract.
For brokerage accounts: company name, DED trade licence, Office Registration Number (ORN), company address and logo.
KYC documents you upload for verification: BRN card (front and back), Emirates ID and a selfie.
Profile information you choose to share: job title, biography, languages, years of experience, avatar and cover photograph.
E-signature specimen you draw when signing contracts, and - where you use it - UAE Pass identity attributes released to us at sign-in or signing.

2.2 Listings and business data

Property details: title, description, type, purpose (sale, rent, both), completion status, price, cheques, payment option, commission terms, exclusivity, community, city, developer, tower, unit number, amenities, area and bedroom counts.
Media you upload: photographs, floor plans and 360° panoramas.
Regulatory identifiers: permit number and permit authority (DLD, RERA, ADM, RAK, SRE) as required to legally advertise a UAE property.
Optional map coordinates you drop for a listing.
"Internal-only" data - including owner name, owner phone number, exact unit number and private notes - that you flag as visible only to you, your company and platform staff.
Client requirements you capture: property brief, budget, preferred locations, client name and phone (optional).

2.3 Communications and deal data

Messages and attachments you exchange with other agents through the Platform inbox, including message metadata and read receipts.
Deal records: parties, commercial terms, agree/decline events, signature timestamps, signed contract PDF and its integrity hash.
Support tickets you open and the responses we send.

2.4 Financial and subscription data

Plan and subscription status, trial dates, billing cycle and invoice history.
Payment identifiers returned by our payment processor. We do not store full card numbers on our servers.

2.5 Technical and usage data

IP address, browser type and version, operating system, device type and screen size, application version and language settings.
Access logs, referring page, timestamps, features used, listings viewed and search queries you enter on the Platform.
Approximate geographic area derived from your IP address for security and analytics.
Precise location - only if you explicitly opt-in when dropping a map pin on a listing, or when you allow the mobile app to use your device location.
Push-notification tokens issued by Firebase Cloud Messaging or web-push, if you enable notifications.

2.6 Cookies and similar technologies

We use strictly necessary cookies to keep you signed in, protect your session against CSRF attacks and remember your language and dark-mode preferences. We use analytics cookies only where you consent to them. See Section 8 below.

3. How we collect your information

Directly from you - when you register, complete your profile, upload documents, publish listings, capture requirements, send messages, sign deals or contact support.
Automatically - through cookies, server logs and analytics as you interact with the Platform.
From third parties - for example, identity attributes released by UAE Pass when you use it to sign in or e-sign, name and email released by Google or Facebook when you use social sign-in, and public RERA/DED registers we may consult to verify a licence.

4. Legal basis for processing

Under the UAE PDPL, we rely on the following legal bases:

Performance of a contract - to give you access to the Platform, host your listings, run matching, deliver messages, generate contracts and process billing.
Compliance with a legal obligation - to verify licensing (BRN/ORN/DED), respect record-keeping obligations, and respond to lawful requests from UAE authorities.
Legitimate interests - to keep the Platform secure, prevent fraud and abuse, understand product usage and improve our service, in a way that does not override your fundamental rights.
Consent - where required by law, for example for marketing communications, non-essential cookies or precise location on your mobile device. You may withdraw consent at any time.

5. How we use your information

Operate the Platform features you ask for: matching, messaging, deals, contracts, e-signature, mobile push notifications and property listing publication.
Verify that you are a licensed real-estate professional (BRN/ORN/DED) and enforce RERA compliance across the Platform.
Prevent fraud, abuse and impersonation, and enforce our Terms and Conditions.
Send transactional emails and notifications - one-time passwords, deal updates, match alerts, receipt of payments, security alerts.
Improve the product, measure feature performance and understand aggregate usage patterns.
Provide customer support and respond to your requests.
Send marketing communications about ATOA features, tips and events, only where you have opted in. You can unsubscribe at any time.

6. Sharing and disclosure

We do not sell your personal data. We share information only in the following circumstances:

With other Platform users - the profile, listings, requirements and messages you publish or send are shown to the intended recipients (for example, the counter-party agent in a deal, or the network of agents browsing public inventory). Information you mark "internal-only" is limited to you, your same-company teammates and platform staff.
With clients through share links - when you create a client-view share link, the property information you selected is shown to whoever opens the link. You control what is included.
With service providers acting on our behalf - cloud hosting (LiteSpeed on cPanel), email delivery, SMS/OTP delivery, payment processing, error monitoring, analytics and push-notification providers. Each is bound by confidentiality and only processes what is strictly necessary.
With regulators and authorities - when we are required by UAE law or by a validly issued order, including RERA, the Central Bank and law-enforcement bodies.
In a corporate transaction - if ATOA is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred subject to appropriate safeguards.

7. International data transfers

Our primary infrastructure is located in the United Arab Emirates. Some of our service providers (for example, email deliverability, error monitoring and push-notification services) may process data outside the UAE. Where we transfer personal data outside the country, we rely on legal mechanisms recognised by the UAE PDPL and take reasonable steps to require equivalent protection.

8. Cookies and tracking

We use the following categories of cookies and similar technologies:

Strictly necessary - to keep you signed in, protect the session against CSRF, and remember accessibility choices. These cannot be turned off.
Preferences - to remember your language, direction (LTR/RTL) and dark-mode setting.
Analytics - to understand aggregate feature usage. Only set with your consent.

You can manage cookies in your browser settings. Disabling strictly-necessary cookies will break the Platform.

9. Data retention

Signed Agent-to-Agent contracts and related deal metadata are retained for seven (7) years, in line with UAE commercial record-keeping requirements.
Account, profile and listings data are retained while your account is active.
If you close your account, we retain a minimal record of the closure and any legally required contract data; other personal data is deleted or irreversibly anonymised within twelve (12) months, unless a legal hold applies.
Access logs and security-relevant data are retained for a shorter period, typically 12 months.
Support tickets are retained for up to 24 months after the ticket is closed.

10. Data security

Passwords are stored using strong, salted bcrypt hashes; we do not have access to your plaintext password.
All traffic to the Platform is served over HTTPS with HTTP-only, secure session cookies.
API access from the mobile app uses per-user bearer tokens that are rotated on every sign-in and sign-out.
Two-factor authentication is available for every account.
Internal access to production systems is restricted, logged, and reviewed.
Uploaded documents are stored with strict permissions and are not indexed by search engines.

No online service can guarantee absolute security. If we ever discover a breach affecting your data, we will notify you and the UAE authorities in line with our legal obligations.

11. Your rights

Subject to the UAE PDPL, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate data - most of your profile is editable in Settings.
Request deletion of your data - subject to the retention limits above (for example, signed contracts we are legally required to keep).
Object to, or restrict, certain processing activities - for example, marketing emails.
Withdraw consent you have previously given, without affecting the lawfulness of processing carried out before the withdrawal.
Request the portability of data you have provided to us in a structured, commonly used, machine-readable format.
Lodge a complaint with the UAE Data Office if you consider that our processing infringes your rights.

To exercise any of these rights, email privacy@atoa.ae. We will respond within the timeframes required by law.

12. Children's privacy

The Platform is not directed at children. You must be at least 18 years old (and a licensed real-estate professional or their duly authorised representative) to create an account. We do not knowingly collect personal data from anyone under 18.

13. Third-party links and services

The Platform may contain links to third-party websites, embed content from services such as OpenStreetMap or Pannellum, or use identity providers such as Google, Facebook and UAE Pass. Their own privacy notices apply to their processing of your data.

14. Changes to this policy

We may update this Policy from time to time to reflect changes in our practices or the law. When we make material changes, we will notify you inside the Platform or by email before they take effect. The "Last updated" date at the top of this page always reflects the current version.

15. Refund & return policy

ATOA sells subscription plans that unlock features on the Platform - no physical goods are shipped. The following terms apply to every paid plan.

14-day cooling-off period. If you cancel a new paid subscription within 14 calendar days of the first successful charge AND you have not used the paid features materially (e.g. published more than 5 listings, sent more than 10 broker messages, or downloaded more than 3 developer brochures), we will refund the fee in full.
Pro-rated refunds after 14 days. For annual plans cancelled after the cooling-off period we refund the unused whole months, minus any promotional discount already consumed. Monthly plans are not refundable after day 14 but you keep access until the end of the paid period.
Duplicate or accidental charges. If you were charged twice for the same period, or a renewal happened after you had cancelled, contact us within 30 days and we will reverse the extra charge in full.
Account termination by ATOA. If we suspend or terminate your account for a breach of the Terms of Service, no refund is due. If we terminate for a reason unrelated to your conduct (for example, we shut a plan down), we refund the unused portion.
Refund method. Refunds are returned to the original payment method within 7–14 business days. Bank processing timelines are outside our control.
How to request. Email support@atoa.ae from the email address on your ATOA account with the subject "Refund request" and a short reason. We reply within 3 business days.

16. Contact us

Privacy questions, data-subject requests or complaints: privacy@atoa.ae

General support: support@atoa.ae